Basic auth is great. It lowers the barrier of entry, to anyone with a browser.
Not all users of APIs are developers.
For http basic auth, you may as well just "secure" the resource by hosting it at http://my-username-and-password.example.com or http://example.com/username/password/resource
Yes absolutely https.